Windows Step-by-Step

Which Service Is Responsible To Register A and PTR Records In DNS?

2011-08-25T10:01:00.001+05:30

Every computer on the network has to register the DNS Records in the DNS Server so that a computer can be accessed by name also. The DNS Query will always go to DNS Server for resolving Name to IP and vice-versa.

The following services are responsible to register (A) Host Record and PTR Records when the client computers start:

DHCP Client Service
A computer running Windows XP, Windows 2000, Windows 2003 use DHCP client service to register Host and PTR Records in the DNS Server.

DNS Client Service
A computer running Windows Vista, Windows 7 and Windows Server 2008 always use DNS Client service to register Host and PTR Records in the DNS Server. Computers running these version of windows do not use DHCP Client Service.

Why DNS Works On Both TCP and UDP

2011-08-25T09:49:00.007+05:30

DNS and some other Services work on both the TCP and UDP Protocols. Two protocols are different from each other. TCP is a connection-oriented protocol whereas UDP is a connection-less protocol. TCP requires the data to be consistent at the destination and UDP does not require the data to be consistent or does not need to establish the connection with the host for data accuracy.

DNS uses TCP for Zone Transfer over Port: 53

It is necessary to maintain a consistent DNS database between DNS Servers. This is achieved by the TCP protocol. This communication happens between DNS Servers only. The Zone Transfer feature of DNS Server will always use TCP protocol. The connection is established between the DNS Server to transfer the zone data and Source and Destination DNS Servers will make sure that data is consistent by using TCP ACK bit.

DNS uses UDP for DNS Queries over Port: 53

A client computer will always send a DNS Query using UDP Protocol over Port 53. If a client computer does not get response from a DNS Server, it must re-transmit the DNS Query using the TCP after 3-5 seconds of interval.

A Quick Tip To Reconfigure Windows Time Service

2011-08-25T09:48:00.002+05:30

Windows Time Service is used by the client computers or Server computers to sync time with its Domain Controllers or authenticators. Sometimes, Windows Time Service modules may be corrupted. You can use the steps mentioned below to reconfigure the Windows Time Service with its default settings:

Steps:

Go to Command Prompt and type the following commands:

Net Stop W32time
W32tm.exe /unregister
W32tm.exe /register
Net Start W32time

The above commands re-register the Windows Time Service module; Win32Time.DLL and its sub-components.

A Quick Tip To Modify The Interval For DHCP Database Cleanup

2011-08-25T09:35:00.002+05:30

DHCP Server must delete the "expired records" from its database (dhcp.mdb file) so that it releases space for new IP Addresses. By default, it does every 4 hours. You can modify this value by hacking the following registry entry:

KEY Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer
Entry Name: DatabaseCleanupInterval
Type: REG_DWORD
Value: (in minutes), default is 4 hours.

A Quick Tip To Prevent Users From Accessing The Computer Tab

2011-08-24T11:58:00.001+05:30

You may need to prevent your users from accessing the Computer Tab on My Computer property for security or some other reason. There is no any Group Policy setting available to disable this but you can set the permissions on the NetID.DLL file which implements the necessary functions to show this Tab on My Computer property. You need to use the steps mentioned below to do so:

Steps:

Search NetID.DLL file on the local computer.
Remove or set the following permissions to hide the Computer Tab.

Administrators - Full Control
Power Users - Read & Execute, Read
System - Full Control

The default NTFS permissions are:

Administrators - Full Control
Power Users - Read & Execute, Read
System - Full Control
Users - Read & Execute, Read

Note: You can also create a script to deploy the permissions set on NetID.DLL using the Group Policy.

What To Check If A Single User Can't Log On To Domain?

2011-08-24T11:47:00.003+05:30

Sometimes a single user might be not able to log on to domain. You can follow the checklist given below:

Make sure:

You can ping the domain controller from the user's computer.
There is no white space in the User's Home Profile in User's Property > Check it using the DSA.MSC.
The user computer is configured with the correct DNS Server to find the domain controller > Check in TCP/IP property of the user's computer.
The Computer Account in the domain for the user's computer is not missing > Check using the DSA.MSC
The Computer Account in the domain is not disabled > Check using the DSA.MSC
The Time between the domain controller and the client computer is synchronized > Check using Net Time command.
The Domain Controller can be found > Check environment variables and check "LOGONSERVER" value or execute Nltest /DsGetDc:domain to re-locate the domain controller for the user.

Using the Remote Desktop Client from the Command Prompt

2011-08-24T11:41:00.003+05:30

The Microsoft remote desktop client can be found in %systemroot%/system32/mstsc.exe. Running this program with no extensions will bring up the remote desktop connection program. However, mstsc.exe has a full set of switches that can be used to accomplish things from the command prompt.

mstsc.exe {ConnectionFile | /v:ServerName[:Port]} [/console] [/f] [/w:Width/h:Height]

/v - specifies the remote computer and port (optional) you wish to connect to
/console – connects to the console of a Windows Server 2003 based system
/f – starts the remote desktop connection in full screen mode
/w & /h – specifies the width and height of the remote desktop connection

This can be very useful in creating batch files to use as quick routes to machines with a particular group of settings. For instance, mstsc.exe can be called from a batch file enforced by group policy to run at startup for machines that need to connect directly to a terminal server for use.

Disabling the RunAs Command

2011-08-24T11:38:00.001+05:30

For standalone Windows XP machines in a workgroup environment, you can disable Run As by hacking the Registry. Simply use Regedit.exe to locate the following key on each machine:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

Then create a new DWORD value named HideRunAsVerb and assign it a value of 1.

In a domain environment, you can disable RunAs using the Software Restriction Policies feature of Group Policy. To do this, open the appropriate GPO in the Group Policy Object Editor and locate the following node in the console tree:
Computer Configuration/Windows Settings/Security Settings/Software Restriction Policies

Right-click on this node and select New Software Restriction Policies, then right-click on Additional Rules and select New Path Rule. Now type the path to runas.exe and make sure the policy is set to disallowed.

If you prefer to apply this policy to specific users instead of computers, use a GPO linked to an OU where the user accounts reside and configuring Software Restriction Policies using User Configuration instead of Computer Configuration, such as:

User Configuration/Windows Settings/Security Settings/Software Restriction Policies

Windows Tips

2011-07-20T13:46:00.003+05:30

Using the Remote Desktop Client from the Command Prompt

The Microsoft remote desktop client can be found in %systemroot%/system32/mstsc.exe. Running this program with no extensions will bring up the remote desktop connection program. However, mstsc.exe has a full set of switches that can be used to accomplish things from the command prompt.

mstsc.exe {ConnectionFile | /v:ServerName[:Port]} [/console] [/f] [/w:Width/h:Height]

/v - specifies the remote computer and port (optional) you wish to connect to
/console – connects to the console of a Windows Server 2003 based system
/f – starts the remote desktop connection in full screen mode
/w & /h – specifies the width and height of the remote desktop connection

This can be very useful in creating batch files to use as quick routes to machines with a particular group of settings. For instance, mstsc.exe can be called from a batch file enforced by group policy to run at startup for machines that need to connect directly to a terminal server for use.

Windows Tips

2011-07-20T13:40:00.001+05:30

To Prevent Users From Accessing The Computer Tab

Search NetID.DLL file on the local computer.
Remove or set the following permissions to hide the Computer Tab.

Administrators - Full Control
Power Users - Read & Execute, Read
System - Full Control

The default NTFS permissions are:

Administrators - Full Control
Power Users - Read & Execute, Read
System - Full Control
Users - Read & Execute, Read

Note: You can also create a script to deploy the permissions set on NetID.DLL using the Group Policy.

Troubleshootings

2011-07-20T13:32:00.003+05:30

How to restore Windows Server 2003 system files

Problem:

How to restore Windows Server 2003 system files
How to replace a missing or corrupted system file or driver

Solution:

There are multiple solutions for this:

SOLUTION 1:

Extract the file using the automated System File Checker

Click Start > Run
In the Run dialog box, type the following text:

sfc /scannow
Click OK.

The Windows File Protection dialog box appears and a system scan begins.
You may have to insert your Windows installation CD.
Follow the prompts.

SOLUTION 2:

Use the System Configuration utility to restore a system file(s)

Insert your Windows Server 2003 installation disk into your CD drive or DVD drive.
Click Start > Run
In the Run dialog box, type the following text:

Msconfig
Click OK.
On the General tab, click Expand File.
In the File to restore box, type the name of the file you want to expand.

Or, to locate the file you want to replace, click Browse File, and then click Open.

In the Restore from box, type the path from which to restore the file.

Or, to locate the source file you want to expand on your Windows Server 2003 installation disk, click Browse From, and then click Open.

If the Save file in box is not already populated from step 4, type the path to which you want the file to be restored.

Or, to locate the destination folder you want to expand the file into, click Browse To, and then click OK.

Click Expand.

SOLUTION 3:

Use Expand.exe at a command prompt to restore a system file(s)

Insert your Windows Server 2003 installation disk into your CD drive or DVD drive.
Click Start > Run
In the Run dialog box, type the following text:

cmd
Click OK.
In the command prompt type the following:

cd\
Press ENTER.
At the command prompt, type:

expand -r

Where is the path to the file that you want to expand on the Windows Server 2003 installation disk, and is the path to the location where you want to save the file,

EXAMPLE:
expand –r D:\i386\sfc.dl_ %systemroot%\system32
Press ENTER.

SOLUTION 4:

Use Expand.exe at from the run line to restore a system file(s)

Insert your Windows Server 2003 installation disk into your CD drive or DVD drive.
Click Start > Run
In the Run dialog box, type the following text:

expand -r

Where is the path to the file that you want to expand on the Windows Server 2003 installation disk, and is the path to the location where you want to save the file,

EXAMPLE:
expand –r D:\i386\sfc.dl_ %systemroot%\system32
Press OK.

Windows Tips

2011-07-20T13:27:00.002+05:30

How to Unhide My File and Folder Caused by Virus

I. Sometimes this infection can be solved by:

Going to Windows Explorer
Tools menu
Folder Option
View Tab
Choose “Show Hidden Files and Folders”.
If the files will show up, simply change the properties of the files/folders. Uncheck the “hidden” checkbox and the files will show again just like before.

II. If the above doesn’t work, and your files are still hidden, do this one that will surely work.

Go to the command prompt.
Go to the drive where your hidden files are located.
Type the following: attrib -s -h /s /d *.* (this will unhide all your files that have been hidden by the virus) i.e. F:\> attrib -s -h /s /d *.*

Windows Tips

2011-07-20T11:26:00.004+05:30

What is lsass.exe:

The process lsass.exe serves as the Local Security Authentication Server by Microsoft, Inc. It is responsible for the enforcement of the security policy within the operating system. This process checks whether a user’s supplied identification is valid or not whenever he or she tries to access the computer system.

With the execution of the file lsass.exe, the system acquires security by preventing the access of unwanted users to any private information. The file lsass.exe also handles the password modifications done by the user.

The process lsass.exe mainly operates in the system through its ability to create access tokens. These tokens encapsulate the file’s security descriptor, which contains the necessary information to process user authentication such as data on which user holds access to the system and whether the access is mandatory or discretionary.

What is ntfrs.exe:

ntfrs.exe is process belonging to Windows. It is used to maintain file synchronization of file directory contents among multiple servers. This program is important for the stable and secure running of your computer and should not be terminated.

Note:-lsass.exe & ntfrs.exe is a system process that is needed for your Windows system to work properly. It should not be removed.

Windows Tips

2011-07-20T11:21:00.001+05:30

1-) How to rebuild the Windows boot.ini.

Users who have a corrupt or missing boot.ini file, are running Microsoft Windows XP, and have a Microsoft Windows XP CD can rebuild the systems boot.ini file by following the below steps.

Insert the Microsoft Windows XP CD into the computer. Note: If you have a system recovery CD or restore CD (not a Microsoft CD) these steps will likely not work for your computer.
Reboot the computer with the CD and press any key when prompted to press any key to boot from the CD.
Once in the Microsoft Setup menu press R to open the recovery console.
Select the operating system you wish to use; if you only have Windows XP on the computer you will only have one prompt.
Once prompted for the password enter the Admin password and press enter.
Once at the command prompt type bootcfg /rebuild to start the rebuild process.
The rebuild process will step you through a number of steps depending upon how many operating systems you have on the computer and how the computer is setup. Below is a listing of the common steps you are likely going to encounter.

* Prompt for the identified versions of Windows installed. When you receive this prompt press Y if the bootcfg command properly identified each of the Windows operating systems installed on the computer. It is important to realize this command will only detect Windows XP, Windows 2000, and Windows NT installations.

* Prompt to enter the load identifier. This is the name of the operating system for the boot.ini. For example, Microsoft Windows XP Home users would enter Microsoft Windows XP Home edition.

* Prompt to Enter OS load options. When this prompt is received type /fastdetect to automatically detect the available options.

Once you have completed all the available options in the rebuild and are back at the prompt type exit to reboot the computer.

2-)To configure the boot.ini file through CMD:

Open a command window and navigate to the root of the boot directory.
Type the following text at the command line.

3.           C:/>attrib -s -h -r boot.ini

This procedure removes the system, hidden, and read-only attributes of the file.

4. C:/>boot.ini edit

5. file will open in notepad and now u can modify boot.ini file.

Firewall on Servers

2011-07-15T09:49:00.000+05:30

Windows Firewall: DNS server

Add UDP port 53 and TCP ports 53, 139, and 445 to the Windows Firewall exceptions list.

Windows Firewall: DHCP server

Add UDP ports 67 and 2535 to the Windows Firewall exceptions list on the DHCP server.
Important:
When you create a Windows Firewall exception for the DHCP protocol on a DHCP server, you must set the scope for the exception to Any computer including those on the Internet. If you leave it set to My network (subnet) only, all inbound DHCP Discover packets from client computers are dropped because the IP address of the packet is 0.0.0.0, which is not recognized by the computer as being part of the local subnet. This causes the DHCP process to fail and clients do not receive IP addresses.

Windows Firewall: File server

Enable the File and Printer Sharing exception in Windows Firewall.

Windows Firewall: Print server

Enable the File and Printer Sharing exception in Windows Firewall.

Windows Firewall: Remote access/VPN server

Turn off Windows Firewall. Stop the Windows Firewall/Internet Connection Sharing (ICS) service.

Windows Firewall: Remote installation server

Add TCP ports 139 and 445 to the Windows Firewall exceptions list.
Add UDP ports 67, 69, and 4011 to the Windows Firewall exceptions list.

Windows Firewall: FTP server

Add the port used for incoming FTP traffic to the Windows Firewall exceptions list. This is usually TCP port 21.

Windows Firewall: SMTP server

Add the port used for incoming SMTP traffic to the Windows Firewall exceptions list. This is usually TCP port 25.
For Secure Sockets Layer (SSL) requests, add TCP port 465 to the Windows Firewall exceptions list.

Windows Firewall: Telnet server

Add TCP port 23 to the Windows Firewall exceptions list.

Windows Firewall: Terminal server

Enable the Remote Desktop exception in Windows Firewall.
If Terminal Server and Terminal Server Licensing are running on separate computers, add TCP port 135 to the Windows Firewall exceptions list.

Windows Firewall: SNMP server

Add UDP port 161 to the Windows Firewall exceptions list.

Windows Firewall: Web server

Add the ports used for incoming HTTP and HTTPS traffic to the Windows Firewall exceptions list. These are usually TCP port 80 and TCP port 443, respectively.

Troubleshootings

2011-07-15T09:34:00.002+05:30

Dnscmd.exe: (DNS Server Troubleshooting Tool)

Example 1: Display a complete list of zones on a DNS server

To see a complete list of zones on your DNS server, type:
dnscmd reskit.com /enumzones

Example 2: Display the RecursionTimeout setting from a DNS server

To display the RecursionTimeout setting from a DNS server, type:
dnscmd reskit.com /info recursiontimeout

Example 3: Delete a zone from a DNS server

To delete the test.reskit.com zone from a server, type:
dnscmd reskit.com /zonedelete test.reskit.com

Example 4: Export zone resource records list to a file

To export the resource record list from the test.reskit.com zone on the reskit.com DNS server, type:
dnscmd reskit.com /zoneexport test.reskit.com test.reskit.com.dns

Example 5: Display RefreshInterval setting from the registry

To display the values in the RefreshInterval entry in the registry, type:
dnscmd reskit.com /zoneinfo test.reskit.com refreshinterval

Windows 2003 support tools

2011-07-13T11:23:00.002+05:30

Replmon

http://www.mcmcse.com/microsoft/guides/replmon.shtml

What is Replmon.exe?
Replmon is the first tool you should use when troubleshooting Active Directory replication issues. As it is a graphical tool, replication issues are easy to see and somewhat easier to diagnose than using its command line counterparts.

Symptoms of Replication Faults

Failure to extend the schema – The Active Directory schema has to be extended for many reasons. Two of the most common are:

When installing an Exchange 200x server (by running setup.exe /forestprep and /domainprep)
When adding a 2003 Domain Controller to a Windows 2000 Active Directory network (by running adprep /forestprep and /domainprep).

If there is a replication issue with any of the domain controllers on the Schema partition, the Schema will not allow any extension.

Failure to DCPromo a new Domain Controller – When installing a new Domain Controller, the wizard waits until Active Directory is fully synchronised before continuing. Replication issues would cause this to hang at this point. (Although it can be forced to wait until later, this would only put off the problem).
Installation of Active Directory aware software – Software that creates a new user account per network or writes to the Active Directory could fail or produce ambiguous errors when replication issues exist on the network.
Any recent warnings or errors in the File Replication Service log in Event Viewer
Any recent NTDS Replication Errors in the Directory Service log in Event Viewer

How to Use Replmon

To use Replmon logon to a Domain Controller, select Start|Run, type Replmon, and click OK. You will be presented with the following screen:

Right click on the Monitored Servers icon and select Add Monitored Server...

Select the Search the directory for the server to add radio button.

Ensure the correct domain populates in drop down list, and click Next.

Select an appropriate server from the list of Domain Controllers…

If you know you are experiencing issues with a particular domain controller, choose that server.
If you are checking general replication, or are not sure where the fault lies, choose the Forest Root.
On larger networks, you will need to choose more than one server depending on the replication topology.
(For information on viewing the replication topology, see Appendix A) …and click Finish.

If your Active Directory contains only Windows 2000 domain controllers, you will see three Directory partitions.

If your Active Directory Forest Root is Windows 2003 you will see five Directory partitions.

By expanding the + on each directory partition you will be able to see each of the server’s replication partners. Selecting one on the left shows the last replication attempt in the right hand pane.

If there are any replication issues the partitions on the domain controller the server cannot replicate with will show a red x.

Highlighting one of the problem replication partner servers will then show more verbose error messages in the logs pane explaining why it could not replicate.

Troubleshooting Replication Issues

Step 1: Check validity of replication partners
Perhaps an obvious step, but there can be replication issues when there are servers present in the replication topology that are no longer connected to the network. Look for replication agreements with non-existent servers, servers that have been forcibly removed from the domain or are simply turned off.

Step 2: Force replication
The last scheduled replication attempt could have failed for unaccountable reasons, but the failure cause may no longer be an issue. Get an accurate current understanding of the situation by right clicking on the replication partner server in each of the partitions and selecting “Synchronise with this Replication Partner”.

Then refresh the Tree view by pressing F5. Re-check the replication status in the right hand logs pane.

Step 3: General IP checks
Doesn’t matter if you’ve done them, do them all again now! From a command prompt:

Can you ping the IP address of the destination server? e.g. Ping 192.168.3.201
If not: The issue will either be hardware (cable, switch, NIC, check all physical connections) or incorrect configuration of a server’s (either destination or host server) IP details. Check the NIC’s IP address and Subnet Mask.
Can you ping the netbios name of the destination server? e.g. Ping Replicadc1
If not: The issue will be a name resolution issue. Check there is an A host entry in the domain’s Forward Lookup zone. Check the NIC IP properties and ensure the Forest Root IP is entered as the Preferred DNS Server.
Can you ping the FQDN of the destination server? e.g. Ping Replicadc1.RMTDS.Internal
If not: The issue will be a DNS issue. Check as above, also check the NIC’s IP Advanced Properties and ensure the correct DNS Suffix is being used. Open the DNS admin console and ensure there is a populated Forward Lookup zone for the domain.
Can you reverse lookup the IP of the destination server? e.g. Ping –a 192.168.3.201
If not: You have a reverse lookup zone issue. Open the DNS admin console and check for the existence of a Reverse Lookup zone per Class C IP range. e.g.

10.0.0.x Subnet
10.0.1.x Subnet

Check there is a valid PTR record for each of the Domain Controllers in the relevant Reverse lookup zone.

Appendix A – Other Replmon functions

By right clicking the server you have selected to view Replication agreements from, you will see a range of options. A few of them are detailed below.

Update Status – This will recheck the replication status of the server. The time of the updated status is logged and displayed in the right hand pane.

Check Replication Topology – This will cause the Knowledge Consistency Checker (KCC) to recalculate the replication topology for the server.

Synchronize Each Directory Partition with All Servers – This will start immediate replication for all of the server’s directory partitions with each replication partner.

Generate Status Report - Creates and saves a verbose status report in the form of a log file.

Show Domain Controllers in Domain – will show a list of all known Domain Controllers.

Show Replication Topologies - will show a graphical view of the replication topology. Click View on the menu and select Connection Objects only. Then right click each server, and select Show Intra/Inter-site connections.

Show Group Policy Object Status – shows a list of all the Domain’s Group Policies and their respective AD and Sysvol version numbers.

Appreciating the Scope of Replmon

Unlike other Windows Server 2003 tools where you can practice on just one Domain Controller, with Replmon you need two Domain Controllers to see any action. In fact the more Domain Controllers you add, the more you appreciate the clever ways in which replication functions. Best of all, if you have a multi domain forest, then you can trace the differences between domain and forest topologies. Theory says that all domain controllers in the forest share the same schema, with Replmon you can actually see the one Schema ring containing every domain controller. Contrast the Schema ring with domain ring which has a separate ring topology for each domain.

My advice is to begin by right clicking the ServerName object, from the resulting drop down menu select, 'Show Replication Topologies'. As well as viewing how all the domain controllers are linked, this example shows the value of right-clicking on any object that you meet. At first it seems as thought there is nothing to see, but if you click on the View Menu, Connection Objects only, then all Domain Controller appear.

Hmm.... still no sign of the replication links. Let us try another right click, and select 'Show Intra-Site Connections'. At this point I pay attention to detail. I remember that Intra means within, whereas Inter is like Inter-City and means between. What you should now see is topology links between all the Domain Controller. Incidentally, the word 'Site' reminds us that to begin with, we are investigating just the Default-First-Site, in a production network there may be multiple sites.

If you have 5 or more servers in the ring, you may consider right clicking and adding extra links to speed up replication; this is particularly true for Windows 2000 networks where latency is much longer than Windows Server 2003.

You can use ReplMon to do the following:

See when a replication partner fails.
View the history of successful and failed replication changes for troubleshooting purposes.
View the properties of directory replication partners.
Create your own applications or scripts written in Microsoft Visual Basic Scripting Edition (VBScript) to extract specific data from Active Directory.
View a snapshot of the performance counters on the computer, and the registry configuration of the server.
Generate status reports that include direct and transitive replication partners, and detail a record of changes.
Find all direct and transitive replication partners on the network.
Display replication topology.
Poll replication partners and generate individual histories of successful and failed replication events.
Force replication.
Trigger the Knowledge Consistency Checker (KCC) to recalculate the replication topology.
Display changes that have not yet replicated from a given replication partner.
Display a list of the trust relationships maintained by the domain controller being monitored.
Display the metadata of an Active Directory object's attributes.
Monitor replication status of domain controllers from multiple forests.

ReplMon Examples:

Example 1: Generate a status report for a server

In this example, you use ReplMon to create a log file that records replication events for an individual server. This data is used to troubleshoot possible replication errors in the forest or domain.

To create the log file

In ReplMon, select the server in the Monitored Servers section of the window.
On the Action menu, select Server, and then click Generate Status Report. The Save As dialog box appears.
In the Save As dialog box, type a name for the log file to generate, (optionally) select a new path for the file, and then click Save.

The Report Options dialog box appears.
In the Report Options dialog box, select the type of information to be logged.
To save the log file and return to ReplMon, click OK.

Notes

If a log file is given the same name as an existing log file, ReplMon replaces the existing log file without a warning. To avoid this, incorporate the current date in your naming scheme.
To set the default path, on the View menu, select Options, and then use the General tab of the Options dialog box.

Example 2: Display the replication topology for a server

In this example, you use ReplMon to display replication partners of a server, which graphically represents the replication topology.

To display replication partners

In ReplMon, select the server in the Monitored Servers section of the window.
On the Action menu, select Server, and then click Show Replication Topologies.

The View Replication Topology window appears.
In the View Replication Topology window, on the View menu, click Replication Topologies.
In ReplMon on the Options menu, click Report.

Example 3: Display pending replication changes

Each domain controller keeps a record of the last changes received from other domain controllers by using the Update Sequence Number (USN) of the replication partner. In this example changes have occurred on the replication partner and the Active Directory replication process has not propagated those changes to the monitored server. You can use ReplMon to show what objects have changed and therefore need to be replicated to the monitored server. This is done on a per-directory partition basis.

To show what objects have changed

In ReplMon, expand a server to display the list of directory partitions.
Expand and select the replication partner within the directory partition for which you want to view unreplicated changes. Only objects that have changed within the directory partition are displayed.
On the Action menu, click Replication Partner, and then select Check Current USN and Unreplicated Objects.

A separate window opens. Detected changes are displayed and can be saved to a text file. If no changes are detected, a message box informs you of the current USN on the replication partner and that all changes have replicated to the monitored server.

Example 4: Synchronize directory partitions

In this example, you use ReplMon to force a replication event between two directory partitions. By default, directory partitions on servers periodically synchronize with each other. Manual synchronization is necessary only if the network or a server is down for an extended period of time.

To manually synchronize two directory partitions

In the Monitored Servers pane of ReplMon, select the server that needs to be brought up to date.
Expand a directory partition.

A list of replication partners for that directory partition appears.
Select the directory partition that needs to be synchronized.
On the Action menu, click Synchronize with this Replication Partner.
In the dialog box that appears, select any additional parameters for synchronization, then click OK to continue with the synchronization.

Notes

This method works only with direct replication partners.
This method synchronizes only one directory partition at a time. To synchronize all directory partitions at once, on the Action menu, click Server, and then click Synchronize Each Directory Partition with All Servers.

Window 2003 support tools

2011-07-13T11:07:00.000+05:30

NLtest

This command-line tool helps perform network administrative tasks. You can use NLTest to:

Get a list of domain controllers.
Force a remote shutdown.
Query the status of trust.
Test trust relationships and the state of domain controller replication in a Windows domain.
Force a user-account database to synchronize on Windows NT version 4.0 or earlier domain controllers.

NLTest can test and reset the secure channel established by the NetLogon service. This secure channel is established between clients and the domain controller that logs them on. NLTest does not work for clients using Kerberos for authentication since this secure channel is not used with Kerberos.

NLTest Examples

Example 1: Verify DCs in a domain
In this example, the /dclist parameter is used to create a list of domain controllers of the domain fourthcoffee.com
nltest /dclist:fourthcoffee
Example 2: Advanced information about users
In this example, you want to find out detailed information about a certain user. At the command prompt, type:
nltest /user:"TestAdmin"
Example 3: Show trust relationships for a domain
In this example, you want to view the established trust relationships for your domain. At the command prompt, type:
nltest /domain_trusts

Win 2003 SupportTools

2011-07-12T11:51:00.003+05:30

Ntdsutil

Ntdsutil.exe is a command-line tool that provides management facilities for Active Directory Domain Services (AD DS) and Active Directory Lightweight Directory Services (AD LDS). You can use the ntdsutil commands to perform database maintenance of AD DS, manage and control single master operations, and remove metadata left behind by domain controllers that were removed from the network without being properly uninstalled.

ntdsutil.exe is found in the %systemroot%\system32 folder.

Preparation for NTDSutil:

Begin by logging on at a Windows Server (2003 best). I suggest that you create a new folder to hold any logs that NTDSutil creates, for example D:\ ntdsutil. Run a CMD prompt change directory to D: \ntdsutil and at the prompt type, ntdsutil. Unsurprisingly, the actual executable is called ntdsutil.exe and is found in the %systemroot%\system32 folder. With this knowledge, you could copy that ndtsutil.exe file onto another operating system if necessary.

Variety of NTDSutil tasks:

1- Authoritative Restore - Major project, needs careful planning see more here.
2- Security Account Management. Check for duplicate SIDs
3- Reset DSRM password. If you don't know the server's Directory Service account password, then here is your change to reset to a password that you will remember.
4- Files - Available only if you boot the server into Directory Restore Mode. Checks the integrity of NTDS.DIT and moves associated databases.
5- Roles = FSMO Maintenance. Which Domain Controller has which Single Operations Master? Seize roles such as PDC Emulator. Good news, for once you do get a message detailing the transfer you are about to make. My advice is to use Roles in conjunction with netdom or the Active Directory Snap-ins. My point is I could not find a way of displaying who holds which FSMO role with NTDSutil.

1-Authoritative Restore:

a) Go to directory service restore mode.

b) D:\ntdsutil>ntdsutil
ntdsutil: authoritative restore
authoritative restore: restore object OU=bosses,DC=ourdom,DC=com

c) Restart in normal mode.

d) Restore applicable portion of SYSVOL from alternate location.

e) Verify Active Directory restore using event viewer.

f) Use repadmin.

2- check for duplicate SIDs:

     D:\ntdsutil>ntdsutil
     ntdsutil: security account management
     Security Account Maintenance: connect to server BigServer
     Security Account Maintenance: check duplicate sid
      …
   Duplicate SID check completed successfully. Check dupsid.log for any duplicates
    Security Account Maintenance: quit

3- Reset password for DSRM (Directory Services Restore Mode)

Here is where I challenge you to perform a real task. Once upon a time, when your Windows server 2003 was first installed, setup asked the installer for a separate directory service restore mode password. 90% of administrators ignored the box or forgot the password. 50% of Administrator's don't realize that this Directory Services Restore Mode password is different from the normal Administrator password. The two can get out of synch because they are stored in separate databases.
Now is your chance to reset the password that will be required if ever you need to restart the server in Active Directory Restore Mode. In many ways, this is such an insignificant job, in other ways it saves frustration of being thwarted by not having the administrative password for this context.
E:\ntdsutil>ntdsutil
ntdsutil: set dsrm password
Reset DSRM Administrator Password: reset password on server BigServer
Please type password for DS Restore Mode Administrator Account: ********
Please confirm new password: ********
Password has been set successfully.

Reset DSRM Administrator Password: quit
ntdsutil: quit
E:\ntdsutil>restart computer.

4- To move the data file to another folder, follow these steps:

Click Start, click Run, type ntdsutil in the Open box, and then press ENTER.
At the Ntdsutil command prompt, type files, and then press ENTER.
At the file maintenance command prompt, type move DB to d:\temp (where temp is an existing folder that you have created for this purpose), and then press ENTER.
To quit Ntdsutil, type quit, and then press ENTER.
Restart the computer.

5- To move the log files, follow these steps:

Click Start, click Run, type ntdsutil in the Open box, and then press ENTER.
At the Ntdsutil command prompt, type files, and then press ENTER.
At the file maintenance command prompt, type move logs to d:\temp (where temp is an existing folder that you have created for this purpose), and then press ENTER.
Type quit, and then press ENTER.
Restart the computer.

Win 2003 Support Tools

2011-07-11T13:55:00.000+05:30

Repadmin

Repadmin is a command-line tool to view and manually create the replication topology.

Usually, the Knowledge Consistency Checker (KCC) manages the replication topology for each naming context held on domain controllers.

Repadmin Examples:

Example 1: Display the replication partners of a server

The following example uses the showrepl operation of Repadmin to display the replication partners of Server1. This command is also used to find the objectGUID and InvocationID for a server for use with other operations.
No parameters are required for the showrepl operation. A remote connection is assumed; therefore, the server name (DC in the syntax) is included.
Type the following at the command prompt:
repadmin /showrepl server1.microsoft.com

Example 2: Initiate a replication event between two replication partners

The following example uses the replicate operation of Repadmin to make Server2 initiate replication of the domain directory partition for microsoft.com from Server1. In this example, Server1 is the source server and Server2 is the destination server.
The required parameters for the replicate operation are the name of the server that will receive changes (DestDC in the syntax), the name of the directory partition (NamingContext in the syntax), and the name of the server that will send the changes (SrcDC in the syntax).
Type the following at the command prompt:
repadmin /replicate server2.microsoft.com server1.microsoft.com dc=microsoft,dc=com
Press Enter and the following output is displayed:

server2.microsoft.com

Sync from server1.microsoft.com to server2.microsoft.com completed successfully.

Example 3: Initiate a replication event for a specified directory partition with all of its replication partners

The following example uses the syncall operation of Repadmin to make Server1 initiate replication of the domain directory partition for microsoft.com from all of its source replication partners in the same site and to make all of the source replication partners initiate replication for microsoft.com from all of their source replication partners in the same site, and so on.
The required parameter for the syncall operation is the server name (DC in the syntax). The name of the directory partition (NamingContext in the syntax) that will be synchronized is also included in this example. If this name is not included, only the configuration partition is synchronized.
Type the following at the command prompt:
repadmin /syncall server1.microsoft.com dc=microsoft,dc=com

Example 4: Display the highest Update Sequence Number on a server

The following example uses the showutdvec operation of Repadmin to show the highest USNs for a specified directory partition on each replication partner. In this example, there are only two replication partners and the directory partition is the domain directory partition for the microsoft.com domain.
The only required parameter for the showutdvec operation is the distinguished name of the directory partition (NamingContext in the syntax). A remote connection is assumed so a server name (DC_LIST in the syntax) is also included.
Type the following at the command prompt:
repadmin /showutdvec . dc=microsoft,dc=com server2.microsoft.com

Example 5: View unreplicated changes between two servers

The following example uses the showchanges operation of Repadmin to view changes that have not yet replicated between Server1 and Server2. In this example Server1 is the source server and is sending the changes while Server2 is the destination server and is receiving the changes.
This is one implementation of the showchanges operation. For another implementation of this operation see Example 6: Create a file to determine what changes have occurred over a period of time.
The required parameters for this version of the showchanges operation are the objectGuid of the directory partition on the source server (referred to as SourceDCObjectGUID in the syntax line) and the name of the directory partition (referred to in the syntax line as NamingContext). A remote connection is assumed so the destination server name (referred to in the syntax line as DestDC) is also included.
Type the following at the command prompt:
repadmin /showchanges server2.microsoft.com 5c02bcaf-86d9-4bed-811e-d17a5cebf8bb dc=microsoft,dc=com

Example 6: Create a file to determine what changes have occurred over a period of time

The following example uses the showchanges operation of Repadmin to create a file that records replication changes. By running the showchanges operation later you can compare the file created earlier to the current replication state.
This is one implementation of the showchanges operation. For another implementation of this operation see Example 5: View unreplicated changes between two servers.
The only required parameter for this version of the showchanges operation is the name of the directory partition (NamingContext in the syntax) on which the check should be performed. In this example, the check is performed remotely so the server name (SourceDC in the syntax) is included as well as the /cookie: parameter, along with the name of the file to be created.
Type the following at the command prompt:
repadmin /showchanges dc=microsoft,dc=com server2.microsoft.com /cookie:microsoft.txt

Example 7: Display the connection objects for a server

The following example uses the showconn operation of Repadmin to show connection objects for a server.
No parameters are required for showconn operation. In this example, a remote connection is assumed so the server name (DC_LIST in the syntax) is specified. All connection objects for Server2 are shown.
Type the following at the command prompt:
repadmin /showconn server2.microsoft.com

Example 8: Display the replication signature for a server

The following example uses the showsig operation of Repadmin to show the replication signature for a server.
No parameters are required for the showsig operation. In this example, a remote connection is assumed so the server name (DC_LIST in the syntax) is specified.
Type the following at the command prompt:
repadmin /showsig server1.microsoft.com

Example 9: Display the context handles for the replication process

The following example uses the showctx operation of Repadmin to show the open connections to the server that are established by remote servers.
No parameters are required for the showctx operation. This example specifies the server name (DC_LIST in the syntax) on which the check should be performed.
Type the following at the command prompt:
repadmin /showctx server2.microsoft.com

Example 10: Showing the replication status of a forest using replsummary and wildcard characters.

The following example uses the replsummary operation and a wildcard character to show a summary of the replication status for all the domain controllers in the forest with a name beginning with 'FOURTH'.
Type the following at the command prompt:
repadmin /replsummary FOURTH*

Example 11: Showing the attributes of a specific object.

The following example uses the showattr operation to show the attributes of a specific object in the Active Directory.
Type the following at the command prompt:

repadmin /showattr fsmo_dnm: ncobj:config: /subtree /filter:(objectClass=crossRef) /atts:nCName,dnsRoot,net,dnsRoot,net,biosname,systemFlags /homeserver:FOURTH-DC-26

WSUS

2011-07-11T13:34:00.000+05:30

System Requirements

Supported Operating Systems:Windows 7;Windows Server 2003;Windows Server 2003 Service Pack 1;Windows Server 2003 Service Pack 2;Windows Server 2008;Windows Vista;Windows Vista Service Pack 1;Windows Vista Service Pack 2;Windows XP Service Pack 3

Windows Server 2008 R2, Windows Server 2008 SP1 or later versions, Windows Server 2003 SP2 or later versions, Windows Small Business Server 2008, Windows Small Business Server 2003 and Windows XP SP3

WSUS 3.0 SP2 Server Software Prerequisites:

Notice that additional prerequisites apply for Windows Small Business Server. See the “Windows Small Business Server Prerequisites” section for more information.
Internet Information Services (IIS) 6.0 or later versions
The Microsoft .NET Framework 2.0 or later versions
Server component cannot be installed on Windows client OS
You must have one of the following supported databases installed:

Microsoft SQL Server 2008 Express, Standard, or Enterprise EditionSQL Server 2005 SP2
Windows Internal Database
If one of the supported versions of SQL Server is not installed, the WSUS 3.0 SP2 Setup Wizard will install Windows Internal Database.

Microsoft Management Console 3.0
Microsoft Report Viewer Redistributable 2008
Windows Server 2008 R2 requires WSUS 3.0 SP2. If you use Windows Server 2008 R2, then you should install WSUS 3.0 SP2. Do not install WSUS 3.0 SP1 on Windows Server 2008 R2.
WSUS 3.0 SP2 is not supported for use with Terminal Services on the front-end server in a remote SQL configuration.

2011-07-06T17:23:00.001+05:30

Changing the Tombstone Lifetime Attribute in Active Directory

The tombstone lifetime must be substantially longer than the expected replication latency between the domain controllers. The interval between cycles of deleting tombstones must be at least as long as the maximum replication propagation delay across the forest. Because the expiration of a tombstone lifetime is based on the time when an object was deleted logically, rather than on the time when a particular server received that tombstone through replication, an object's tombstone is collected as garbage on all servers at approximately the same time. If the tombstone has not yet replicated to a particular domain controller, that DC never records the deletion. This is the reason why you cannot restore a domain controller from a backup that is older than the tombstone lifetime.

By default, the Active Directory tombstone lifetime is sixty days. This value can be changed if necessary. To change this value, the tombstoneLifetime attribute of the CN=Directory Service object in the configuration partition must be modified. This object is located here:

 cn=Directory Service,cn=Windows NT,cn=Services,cn=Configuration,dc=

Note: Longer tombstone lifetime decreases the chance that a deleted object remains in the local directory of a disconnected DC beyond the time when the object is permanently deleted from online DCs. The tombstone lifetime is not changed automatically when you upgrade to Windows Server 2003 with SP1, but you can change the tombstone lifetime manually after the upgrade. New forests that are installed with Windows Server 2003 with SP1 have a default tombstone lifetime of 180 days.
You can check your tombstone lifetime attribute by using the following command:

 dsquery * " cn=Directory Service,cn=Windows NT,cn=Services,cn=Configuration,

 dc=" -scope base -attr tombstonelifetime

There are several ways of modifying this attributes value, the easiest is using ADSIEdit.

Using ADSIEdit

The following explains how to modify this attributes value using ADSI Edit.
Note: ADSIEdit is part of the Windows 2003 Support Tools. To get ADSIEdit you need to install the support tools on your computer/DC. Read my "What are the Windows Server 2003 Support Tools? Where can I get them from?" article for more info on how to obtain the Windows Server 2003 Support Tools (insert link to existing article).
In addition, in order to perform the following steps you'll need to be a member of the Enterprise Admins group.
To view or change attribute values by using ADSIEdit:

On the Start menu, point to Run and then type ADSIEdit.msc and press Enter.
Navigate to:

 cn=Directory Service,cn=Windows NT,cn=Services,cn=Configuration,dc=

Where "ForestRootDN" is the Distinguished Name of your Active Directory Forest Root domain. For example, if your domain's name is kuku.co.il, then the DN for it would be:

DC=kuku,DC=co,DC=il

Right-click and choose properties.

4. In the resultant properties dialog, scroll down to tombstoneLifetime, select this attribute and choose Edit.

5. Configure the Tombstone Lifetime Period, then press Ok.

6. Click OK and then close ADSIEdit.

When you view properties on cn=Directory Service,cn=Windows NT, cn=Services,cn=Configuration,dc=, if no value is set it means that the default value is in effect. Any value that you type in the Edit Attribute box replaces the default value when you click Set .
The default value for these two attributes applies if the attribute is not set (the initial state of the system).

Create Users for Testing Purposes

2011-07-01T11:31:00.001+05:30

Method 2: By using the DSADD USER command:

dsadd user "cn=Test User,ou=Test OU,dc=india,dc=net" -samid

testuser -upn testuser@india.net -fn Test -ln User -display

"Test User" -pwd P@ssw0rd -disabled no

This will create one user called "Test User" with all the necessary information (and as I said earlier, more attributes can be easily configured in the same way).
Lamer Note: Note that you want to use the same syntax as above, you must first create the "Test OU" OU in you AD, and also change the DN of the domain to the name of YOUR domain.
However we would like to create many users for testing purposes. Therefore we can use the FOR command like we did before:

FOR /L %i in (1,1,500) DO dsadd user "cn=Test User%i,ou=Test

OU,dc=india,dc=net" -samid testuser%i -upn testuser%i@india.net

-fn Test -ln User%i -display "Test User%i" -pwd P@ssw0rd -disabled no

This script will create 500 users called Test User1, Test User2 and so on.

Like with NET USER, the DSADD USER command can be used along with a text or CSV file that contains a list of all the users that you want to build.
Create a text file like this one:

Blue,Kelly,bluek,04-6545645

Ben-Sachar,Ido,bensachari,03-7634545

Fluegel,Jay,fluegelj,03-9875765

Grande,Jon,grandej,02-6674534

Hankin,Alex,hankina,04-8856476

Name the file USERS.TXT and place it in a directory.
Now open a CMD in that directory and run the following command:

for /F "eol=; tokens=1,2,* delims=," %%i in (users.txt) do

dsadd user "cn=%%j %%i,ou=Test OU,dc=india,dc=net" -samid

%%k -upn %%k@india.net -fn %%j -ln %%i -display "%%j %%i"

-pwd P@ssw0rd -disabled yes

This will create user accounts with the names found in the USERS.TXT file.
Imagine the power of such a script!

Create Users for Testing Purposes

2011-07-01T11:22:00.001+05:30

Method 1: By using the NET USER command:

FOR /L %i in (1,1,500) DO NET USER MyUser%i /ADD

This will result in creating 500 new users, named MyUser1, MyUser2, etc. You can, of course, customize the FOR command's parameters. See the FOR command help for more options.
You can also set the user's password (in this case - P@ssw0rd) in the same manner:

FOR /L %i in (1,1,500) DO NET USER MyUser%i P@ssw0rd /ADD

You can delete all those users by running the following command:

FOR /L %i in (1,1,500) DO NET USER MyUser%i /DELETE

Note: If run on a stand alone W2K Server, W2K PRO or on an XP machine, this script will create local users. If run on a DC it will create users in the USERS Container in the AD. However, doing so on a domain controller will not create fully AD-compatible users (as you can clearly see if you open one of these users and try to find the User Principal Name - UPN - field).

Note: If you're using a W2K PRO or XP PRO computer that is connected to an Active Directory network and you wish to create local users on that computer - run the command above. However, if you want, from that computer, to create users in the Active Directory database on the DC, use this command instead:

FOR /L %i in (1,1,500) DO NET USER MyUser%i P@ssw0rd /domain /ADD

To create users with pre-configured names (for example - a file with all your company's usernames or a database with usernames) create a text file like this one:

daniel

moshe

yossy

gabi

ran

Name the file USERS.TXT and place it in a directory.
Now open a CMD in that directory and run the following command:

FOR /F %i in (users.txt) DO NET USER %i P@ssw0rd /domain /ADD

This will create user accounts with the names found in the USERS.TXT file, all with the same password - P@ssw0rd. You don't have to use the /domain switch unless you want to.

Change Recovery Console Password

2011-07-01T11:14:00.002+05:30

On Windows Server 2003, the setpwd or NET USER trick won't work. Here, if you want to change the Directory Service Restore Mode Administrator password you'll need to use the following method:

1. Click, Start, click Run, type

ntdsutil

and then click OK.

At the Ntdsutil command prompt, type

set dsrm password

At the DSRM command prompt, type one of the following lines:

To reset the password on the server on which you are working, type

reset password on server null

The null variable assumes that the DSRM password is being reset on the local computer. Type the new password when you are prompted. Note that no characters appear while you type the password.
or
To reset the password for another server, type

reset password on server

where is the DNS name for the server on which you are resetting the DSRM password. Type the new password when you are prompted. Note that no characters appear while you type the password.

At the DSRM command prompt, type q.
At the Ntdsutil command prompt, type q to exit.

You can now use the Administrator account to log on to Recovery Console or Directory Services Restore Mode using the new password.